Bizarre crates.io phishing campaign

Threat Intel
,
1

Observable: crates[.]ws
Observable Type: Domain

Details:

Rust maintainer phishing email sending users to a bogus Crates website.

Interestingly it looks like the .ws domain redirects to .io unless you provide it direct parameters. Unclear the intention though.

Full URI in the email:

https://crates[.]ws/settings/profile?action=verify&e=SOMENUMBER

image
image1760×1707 165 KB

image
image1390×844 247 KB

image
image1003×900 110 KB

image
image528×276 8.92 KB

1 Like
2

You’ll never guess who owns these:

crates.ws.              273     IN      A       104.21.95.240
crates.ws.              273     IN      A       172.67.149.164

Certificate and DNS both brand spanking new.

3

URLScan has a fun subdomain:

github-oauth.crates[.]ws